CVE-2019-10248: eclipse vorto Download of Code Without Integrity Check
CVSS: 8.1v3.0HighModified
AliasesGHSA-fg2q-v428-2gph
Published 22-04-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-10248 is a high (CVSS 8.1) Download of Code Without Integrity Check vulnerability in eclipse vorto. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.3% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.0 (NVD)EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 22-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 19-09-2026
19-09-202619-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
- CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
- CWE-669Incorrect Resource Transfer Between SpheresThe product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Affected systems
Eclipse1 product
- vorto< 0.11
Org.eclipse.vorto1 product
- org.eclipse.vorto.core< 0.11.0
The eclipse foundation1 product
- eclipse vorto≥ unspecified, < 0.11
3 vendors · 3 products
References
3 links
- github.com/eclipse/vortoPACKAGE